IN THE CLAIMS 



Amended claims follow: 
1-6. (Cancelled) 

" iCuueiitU \ mended} \ computet piogtam product embodied on a tangible 
compute; loadable medium ibi controlling a computer to detect tnalwafe said Lomputei 
piogiani ptoduct comprising 

file access request teces\ ing logic ope table, to recet\e at an assessment computer a 
file access cleaiatiee request ftotrt a tequesttrg computet .said tilt; act ess tieaiantc 
iequest intituling data identtfi, ing a compute' file to be acceded b\ said requesting 
computer; 

file access clearance response generating logic operable in dependence upon said 
data kientifs mg said computer file to detenu ne if said computer file lias pte\ toush been 
assessed as not containing malwaie and to generate a file act ess cleat aucc response, ami 

file access cleat ant e icsponse tiansmiUmu iotuc operable to uanstntt said file 
access cleaiance tesponso to said requesting computet, 

wherein said assessment compute! stotes a database of computet hies and said 
database includes for each computer file a persistence flag indicating whether an entn 
telatmg to s<nd computet file sbould be pinged fioni said database dtu tng purge 
operations; 

wherein said database me Slides fin each computet hie fields specifying a filename 
of said computer file, data identtfung said tequcstsng computet and a stoiage location of 
said computet tile and a checksum value calculated from <aid computet file^ 

wheiein said assessment comptttet is upeiable m at least a Isigtiei Se\ei security 
mode and a iewet ie\el setmtty mode, said assessment computet set sing to deny access 
to a gteatei tange of computet files when opaatmg in said liigbet Se\el secuut) mode 
compatt-d with said lowet level security mode 
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8. ( Pres iously Presented) A computes program product as claimed in claim 7, 
wherein said data identifying said computer file includes said checksum value calculated 
from said computer file. 

9 (PiestousK Ptesentedi A computet program ptoduct as claimed in claim 7, 

v\ herein said data identifying said computer file includes one or mote- of said filename of 
said computer iile. said data identifying said requesting computer and said storage 
location of said computer file. 

10 (Outnnal! \ computet progtam ptodtict els claimed in claim whetem it said 
tile access cleatance uspons. indicates a scan of said computet file is retjmu-d b\ said 
assessment compute! then compute! Ide tecen mg logic t<- opeiable to rccen e at said 
assessment computet said computer file fiom said iec]ne^ntg computer and peifotmmii a 
tualwaie ->ca.u of s<mi computet file 

1 ! {i higsnah \ computet ptogiam product as claimed in claim whet em it said 
file access cleataticc response indicates access u> said compute! file is dented then 
tttggeimg a denied access response tn >aid assessment computei 

12 (Puuoukh Presented) A computer piogram pioduct a?- claimed in claim 7 
whetc'tn said database ul computer fles specific 1 whetbei respectn e computet files 
contain ma 1 ware. 

j > (Piewoush Pi evented) A computer piogram pioduct as claimed m claim 12 
whetem said database fuithct includes for each computer file anothei field specifxmg an 
access Hag indicating whether access to smd computet file is denied 

14. (Cancelled) 

1 5. (Currently Amended) A computer program product as claimed in. claim 
[[14]]7, wherein said assessment computer is triggered to change from said lower level 



security mode to said higher level security mode by a lock down trigger message received 
at said assessment computer from a remote computer. 

10 (Curtenth Vmcndcd) \ computer piogiam product as claimed in claim 7 , 
wheieiu a pluialu\ of lequesitng eomputei s -haie access to [[anjjsaid assessment 
computet fos detcttmnmg whether file access lequests b\ those ieque°tmg computet s 
should be denied. 

17. (Currently Amended) A computer program product embodied on a tangible 
computet readable medium for contioUmg a eomputei to detect maiwate said eomputei 
piogiam product cotnpnsitig 

file access iequest detecting logic opctable to detect a file aeces- iequest to a 
computer file bv a ^questing computer 

tile access ileal ance sequel genet a ting logic upeiabie to generate a hie atees, 
clearance request including data ickntib, ma said eomputei file 

ifleacces- cleatance iequest uansmttung logic operable to tiansunt said hie 
access clearance request fu>m -aid requesting computer to an assessment eomputei 
te-ponsible lor assessment of whether sa>d computet ide contains malwaie 

fiL access clearance iequest ieceo.mg loiiic opeubk to Keeise at said assessment 
computet said file access cLarance iequest from a ieqne;>ting computer 

file access cleatance i espouse generating logic operable m dependence upon -.aid 
data identifying said eomputei *ile to dt renin ne it said computet fik has pie\iousK been 
assessed as not containing tualvwite and to utueiate a file access eleaianee t espouse 

tiL access clearance i espouse transmitting logic opetabk to tt< iwml said fik 
access tieaumte lesponse to said tequesting _umputet 

file access cleat an*, e i espouse jecen tag logic operable to teeen e at said 
requesting computer said file access clearance response from said assessment computer; 
and 

file access permuting logic operable if said file access eleaianee lesponse 
indicates said compute! file does not contain mal ware to peunu said file access iequest 
b\ said leqtte^iing compute! 
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wherein satd assessment compute! stotes a database of computet Isles and said 
database includes for each eomputei fi'c a pei silence flag indicating whether an entn 
iehitme tu said computet file should be purged ftom ^aid database dunns> putge 
operations; 

u herein said database includes lot each computet hie fields specifying a filename 
or said computer ilk, data identifying said tequcstmg computet and a stoiage location of 
said computet iile and a checksum \alue calculated hom said computer file^ 

v\ herein said assessment computet is opeiabk m at least a higher Se\el security 
mode and a hmet icel secuut> mode, said assessment computet seising to dem access 
to a gteatet range of computet files when operating ta said fughei Se\el aecuut) mode 
cnmpaicd with said Sower level sccut»> mode 

(Previously l'i evented* \ computet ptoatam piodtict as claimed m claim P, 
vdieiem said data rdeutiiung said computer file includes satd checksum \ alue calculated 
trom said computer file. 

1^ (Pre\iousl\ PresentccO \ computet ptogiam pioduct as claimed m claim 17, 
uheiem said data idcntiKtng satd computet file include-* one oi more of satd filename of 
said computer file satd data ulenuh nig said requesting computet and said Menage 
location of satd computet file 

20 (Original } \ computet ptugram product as claimed m ciatm 1 "\ wlseiem if 
said file aeces-t clearance response indicates a *can oi said computet file is lequued bv 
said assessment computer then computet file ttansmiUmg logic is opetabk to tian»m!t 
said computet tile tiom sard requesting computet to said assessment computer, fecen tng 
at satd assessment computer said computet file from said tequesting computet and 
performing a tnalware scan of said computer file, 

21 (OnginaU A. computer ptogiam pioduct as claimed in claim 17 w herein if 
said hie access cleatance i espouse indicates access to said computet file is denied then 
{nggciing a denied access i espouse in said assessment computer 
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22 (Original) A computet ptogtam pioduct as claimed in claim 17 wheiem if 
=atd ilie access clearance i espouse indicates acce.-s to said computet file is denied then 
faggoting a denied access icsponse jn said ie<]uestmg computet 

2^ (Ptc\iousK Presented) \ compuror psogram piuduet as claimed m claim 1 7 
wheietn s;ud dalaba.se of computer file.s specifies vUuMhet ie.specm e computet ides 
contain ma 1. ware. 

24. {Previously Presented} A computer program product as claimed in claim 23, 
wherein said database further includes for each computer file another field specifying an 
access flag indicating whether access, to said computer file is denied. 

25. (Cancelled) 

2o {t uuentSv \mended) \ compute! ptogtam product as claimed m datm 
L-^FIZ wheiem said assessment computer k> UtgiieKd to change tiom said k*v,u icsol 
sec tints mode to ->aid highet lc\el ->eutut\ mode b\ a lock dovui tiiggei message teeei\cd 
at satd assessment computer fiom <i Rmotc computet 

2" {< uireutiv \mended) \ computet ptogtatn product a<- claimed in claim 17 
wherein a pltitahtv of requesting computers shaie access to [[anllsaid assessment 
computet }o! deteimmmy sshethei iue accost uquest-* b\ tho^e ietiuesung computet s 
should be denied. 

28-33. (Cancelled) 

34. (Currently Amended) A method of detecting tnalware, said method 
comprising the steps of: 
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iecu\ mg ost an assessment computei a file access cieasanee tequest horn a 
lequestmg computei said file access cieasanee leque-l including data identifying a 
computei file to he accessed by said lequestng computet. 

m dependence upon said data sdentifung said computet file duel mining if said 
computet hie has pre> umskv been assessed a-> net containing maiwaic ant! geuetatmg a 
Hie access cleaumce tesponse, and 

tiausnutluig said file access clearance response to said lequestmg computet. 

\\ heiein said assessment compute! stoics a database of computet iile& and satd 
database includes ibt each computei Hie a peisistence flag indicating whethu an cutis 
j elating to ^aul computer file should be puiged fiom stud database dtitmg putge 
operations: 

\Ujeiem ?.aid database includes Joi each computei file fields speeiiwnga filename 
of said computet file d&u identifying said requesting compute! and a storage location of 
said computer file, and a checksum \alue calculated fiom said computei fi!e_ 

therein said assessment computer i^ ope? able m at least a higher level remits 
mode and a Souei le^ el seem uy mode said assessment computei sen nig to den\ access 
to a gieatet range of computet files when opeiating m said higher IcmI seeuim mode 
compaied \\ »h said lowei ie\e1 security mode 

(,Pic\ iou^K Presented) A method as claimed in claim ^ 4, v\ heiem satd data 
identifying said cumptttei file includes said checksum \alue calculated fiom said 
computer file, 

3o (Pie\ loush Presented} \ method as claimed m claim 1 4, w heiein said data 
identifying said computei tile includes one oi mote oi said filename of said computei 
file said data identifying said requesting computer and said stoiage location of said 
computer file. 

37. tPre\iousK Presented) A method as claimed m claim 34, wherein if said iilc 
access clearance response indicates a scan of said computer file is requited by said 
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assessmem computei then ieceiwne at said assessment computet said computet file hom 
said lequesnng computer and puiotminti a iu<il\\aic scan oi ^aul computet Hie 

38. (Previously Presented) A method as claimed in claim 34, wherein if said file 
access cieaianee lesponse indicates access to said computet {tie is denied then tni/geiing 
a dented access response in said assessment computet 

^> (PteMousK l*iesenkd> \ method as. claimed tn dasm U wherein said 
database oi computet fdes specifies whethet lespeeme computet Hies contain mahuue 

40 (FicxioufeK Presented) -\ method as claimed m claim ^9, uheiem sasd 
database ilitthet includes tot each computet tile another field specifying an access Ray 
indicating whether access to »aid computer file us denied 

41. (Cancelled) 

42 (CiiitentK \mended) \ method as claimed in claim | [4 i }}}4 wheteinsaid 
as^es-menf computet i-> tnggetcd to change fiom said hn\ei le\el sectnUv mode to said 
highet le\e! seetum mode b\ < lock down tti<a»et message tecu\ed at >aid assessment 
computet ttotn a t emote compmer 

4* (Currently \metideci) \ method as claimed in claim H, whet em a piuiaht\ ot 
tLtmL^tiiic. computers shaie access to j at) |] said assessment computet Joi detei mining 
whether file access requests b\ those lequestmg compute! s should be duued 

44 (i. utremlv \mendect) \ method of detcctmc malwaie said method 
comprising the steps of: 

detecting a file access request to a computet file by a lequesttng compute i 
getu-tatmg a file access cieaianee teqaest including data identifung said computet 

file: 
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tianstmttmg said file access eleatanee lequest (torn said lequesnna computet to ju 
assessment computer tesponsibie for assessment oi whethet Mid computet file contains 
malware; 

receiving at said assessment computer said file access clearance request from a 
requesting computer: 

m dependence upon --aid data identifsmg said computei file detei mining ii said 
computet file has piewousK been assessed ;»■> not containing mahvate and generating a 
die access dcaiance response, 

transmuting said file access eleatanee icspunse to said requesting computet, 

lecemng at said lequestmg compute! sasd file access clearance iespon.se ftom 
said assessment computei, and 

if said file access defiance i espouse indicates said computer file does not contain 
malware, then peimitttnti said file access rcq.iesf b\ said requesting compute! 

wherein said assessment computet stotes a database oi computei files and ,->aul 
database includes fot each computes file a pwsistetue flag indicating \shethei an entiv 
relating to said computet file should be purged tiom said database duung pitige 
operations: 

wherein said database includes fot each computet i tie fields speuf\inga filename 
of saul computei file, data identify ma said tcqucstma computei and a stoiaty. location of 
said computer file and a checksum \aluc calculated ftom said computei ftL^ 

\Uieiein said asses-mem computet is opetable m at least a Inglici lexel security 
mode and a iov-er level secuuty mode, caul assessment computes sen mg to deny access 
to a gteatei lange oi computei files yihcu opeiatmg in said highet le\el seiunty mode 
compatt-d with said knvei level security mode 

45 (Pie\umsK Presented"* \ method as claimed m claim 44 therein said data 
identifying said computei file moiudes said checksum \alue calculated from said 
computer tile. 

40 (Pre> lousK Presented} \ method as claimed m claim 44 w herein said data 
identifying said computei file includes one oi mote of said filename- of said computei 
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Uk said data ulentihma said itquestnii; computet and -*aid stotagc location i f said 
computer file 

1" ( Pte\mfi\l\ Pic^ented> \ method as claimed in claim fl wherun if said file 
access cieaianee tesponse indicates a scan of said computet file i-> requited Ih said 
assessment computer then tt tnsmutintr said .umputci iile fiom said icqiiestmg computet 
to ^aid assessment computet teeenmg at satd assessment computet said computet file 
horn said lequestmg computet and puiosmmg a malwatt scan ot >aui computet file 

(PkuousK Presented} A method a 4 claimed m claim 44 whetem it said file 
access cleaiatite uspon^ indicates access to said compute) file is denied, tru-n trsggenng 
a denied access response in said assessment computer. 

4V> (PicviousK Pteseuted) A method as claimed m claim 44 wheicm if said file 
access cieaianee i espouse indicates access to said computet file is denied, then tuggetmg 
a dented access tesponse m said lequesnng computet 

^0 (Ptewoush Ptesented)A method as claimed in claim 41 wheicm said 
database of computet Hies specifies whethet lespectne computet files umlaut mafuaie 

s| (PteMutisls Presented"* \ method a.s claimed m claim SO therein satd 
database fuithei includes foi each computer file another field specifXmg an access flag 
indicating wiiethei access to satd computet file is denied 

52. (Cancelled) 

53 {Cmremiy Amended) A method as claimed in claim f [52 j ]44. wheteiu satd 
assessment computer is triggered to chance Jrom said lower ie\el security mode to satd 
higher lesci secunty mode h\ a Sock down tnygei message recei\ed at said assessment 
computet from a remote computet 



^4 (( mienth Amended) V method as claimed in claim 44 wheiein a plutahu ol 
lequestmg computers shatc access, to j'anjjvitd assessment eonvputu foi detummmg 
whefliei file access tcqticcts b\ those lequesting computets should be denied 

55-60. (Cancelled) 

ol (Cuirentlv \tnended) \ppataius {cu controlling a computer to detect mahsase 
^atd appanitus compusuii; 

a fi!e access t<_qu<_st icceivei opeiabie to ieeei\e at an assessment computet a file 
access cleatance leqttest fiom a tequestmu computer said tile access cleatance tequest 
including data identit\ing a computer file to be accessed hv said lequesuna computet 

a file access clearance response genes ator opetable in dependence upon said data 
idcruifvmg said computet file t<> determine if said computet file has p;e\ tousK been 
assessed as not containing malwate and to guictate a file access cleaiance t espouse and 

a tile access cleaiance tcsponv. tiansmiiter opuable to ttansnut said tile access 
cleatance t espouse to satd lequestmg computer, 

wheiein saul assessment computet siotes a datable of computet file.-, and satd 
database includes lot each computes file a persistence Hag indicating whethu an ciitt\ 
ieiatmg to said eompuki fik should be puigtd bom ^aid database dm nig ptttge 
operations; 

whetem saiddataba.se includes loi each totnputei file fields speethmga filename 
of said computet file dsu identifying satd requesting compute! and a storage location of 
said computer tile, and a checksum \alue calculated funn satd computet file.. 

v. herein said assessment computet is opetable m at least a higher lex el <-ecuut> 
mode and a iouei lewl scemm mode saul assessment computer sen nig to den\ access 
to a gieatet range of computet files vJien opetating in satd higher lesei secuttt) mode 
compared with said lower level security mode . 

o2. (Pa-\iou$l> Presented) Apparatus as claimed in claim of wheiem said data 
uientitXing said computer file includes- said checksum \alue calculated from satd 

computer file. 
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(Pro\ iouaK Presented) Apparatus as claimed m claim hucm 3 aid data 
rdentif\mg «aid computer file niciuds-S one 01 moie of said filename oi satd computei 
file said data identihmg said requesting computer and --aid dotage location of said 
computer file. 

04 ij\e> luusK Presented) Apparatus as claimed m claim u] whet em if said file 
access Jcarance response indicates a scan of said computer file is inquired >aul 
assessment computet then a computer file teeenei is operable to reccn e at said 
assessment computes said computet tile bom said leqiiesting computer and peifotmmu a 
malw-au- scan of said computei file 

£> K (Previously Pictured) \ppaiattis as claimed m claim Oi wherem if said file 
access clearance response indicates access to said computet file is denied then inggcuug 
a dented access response m said assessment computet 

oo <Pre\iousl\ Presented) \pparatus aM.Lmned rn claim oi wheieuisaid 
database oi computer files specifies whethet R^peetne computci files contain mahuue 

o? (Cuueuth Amended) Apparatus as claimed m claim u<\ v\ herein said 
database lutthet includes toi each computes file another field -,pecif\ mg_an access Ray 
indicating whether access to said computer file is denied. 

68. (Cancelled) 

o l > {Currently Amended) Apparatus as claimed m claim j|o8}]oI, wherein said 
assessment computer is triggered to change fiont said lower lev cl security mode to said 
hmher le\el security mode bs a lock, down trigger message recerved at said assessment 
computer from a remote computer. 
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7 0 {( uiientb Vmendedt Vppatatus as claimed in claim f>h vJiuein a pbuahts of 
lequesttng computet s shaic access, to j'anjjvitd assessment computet k>i detumnnng 
whefliei file access- i<-qu<-«t& b\ those lequesting computets should be denied 

7 1 {C uiienth Amended) Vppatatu-, for conhoilntg a computet to detect maiwaie 
said appaiatus comprising 

a file access lequess deteckn opetable to doled a tile au.es-> request to a computes 
hie bv a leqtiestuii; computet 

a fi!e access cieaiance tequest generaloi opciahlc to genet ate a file access 
clearance request including data ukntifs mu said computet tile, 

a flic access cieaiance uquw transmitter opes able to transmit '■aid fiie access 
cieaiance icquest now said lequc-ting comp itet to an assessment computer ic^ponsibie 
feu assessment of \\hetrui said computet tile contains maiwaie, 

a fife access cieaiance teque-t iecei%et opeiabie to tec cue at said a^es-meut 
computet said file access cLaiance tequest from a lequesting computer 

a hie access cieaiance i espouse genet at oi opetabie m depc ndeiue upon satd data 
icLimfung said computet file to dctumiiK if sAid computet file has pre\ions!\ been 
as^es-ed as not containing tnah\ate and to guieiale a hie access cieaiance i espouse 

a fiie access cieaiance icsponse tiunsmitter opetabie to tiansmit said fiie access 
clearance response to satd uqikstnii: comptitei 

d file access clearance response tecenet opetabie to iceene at said requeuing 
computer said file access, Jeaumce response ftotn satd assessment computet and 

a fiie access peimission imu opeiabie it ->atd fiie access cleat ance i espouse 
indicate^ said computei file docs not contain malwate to pet nut said fsie access icquest 
In said icquesting comptitei 

wheiein satd assessment computet stotes a database of computet file-, and said 
database includes tot each computet file a petsistence flag indicating whethct an cutis 
t dating to >asd computet file should be pinged ftom --aid database dutitig ptnge 
operations; 
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w herein said database includes tin eaeh computet file fields specifying a filename 
oi\atd computer file, data identifying satd requesting computer and a stoiagc location of 
-•aid computet file and a eheeksum value calculated bom said computer file^. 

whet cm said assessment computet is opes able in at least a huzhet level sceurst\ 
mode, and a hmet level secuntv moderate! assessment computet semne to den\ access 
to a theater taoge of compute! files when opeiantm in said higbot lexti secuut) mode 
compared with said lower level sec turn mode 

72 {PiewousK Picscnted) Appaiatus as claimed m claim 71 wheiem said data 
ideutifvmg saul computer file includes said checksum value calculated ftotri said 
computer tile. 

7* (Previously Pi evented* \ppaiatus as claimed m claim 71. wherein said data 
idenUhmg y,\n\ computer file includes one ot more of -aid filename of said computet 
tile said data identifying satd tcqucstmg computet and said sun age location of said 
computer file. 

7-1 tPtewoush PiL'seuted) \ppaiatus as claimed in Jaim 7i wheiem it said file 
access cleaiancv icsponsc indicates 4l scan of said computet file is requited b\ said 
assessment computer, then a computer file tiansimttei is opesable to ttansmif said 
comptuei file horn satd icquestiug comptuei to said asses-mem computet tecenmg at 
said assessment computer said computei file fiom said leqitcstmii compute! and 
pu forming, a mahvate scan of said computet file 

""S f Pie\iou-dv Ptesentedi Apparatus as claimed m claim vxhciem if said file 
access clearance response indicates access to satd computet file is dented then tuavjenna 
a denied access response In said assessment computer, 

"o. (PreviousK Presented) Apparatus as claimed in claim "M, wbciem if said file 
access clearance response indicates access to said computet file is dented, then titggenng 
a denied access lesponse in said requesting computei. 



"7 (PrcuouaK Pit. scnted) Apparatus a** claimed m claim w herein ^aid 
database uf compute* files specifies w hetliei lespecme computet files contain nuiwaie 

IS {( miemh Amended) Vppatatu-, a* claimed m chum "7, wheietn said 
database further mclficios for each computet file anothei field speeds mg_an access ilag 
indicating whether access to >aid computet hie is denied 

79. (Cancelled) 

SO fTutrcutlv Amended) Apparatus as claimed in claim H^IUL whetetn said 
assessment computer is utggeted to change hum said lo\u*r lesel secunr\ mode to ^aid 
lu<>liei k*\ el seusrm mode b\ a lock dow n rugger message recen ed at said assessment 
compute* horn a remote computet 

S! {{ uuentSs \mended) \pparauis a* claimed m claim 'I herein a pknabt\ ot 
requesting eomputeis shaie access to j [an j j satd assessment computer for detumumig 
uhethci tile a^ces-, requests In those requesting eomputeis should be denied 

82. (Cancelled) 

M (New. ) \ computer ptogram product as claimed m claim 1 1, wherein said file 
access eleaianee response indicates access to said computet file is demed d\aid 
computet file has ptcuoush been tdenfified as containing maivare and said denied 
access i expense includes deletion of said computet file 

M {New ) A computet piogiam ptodwt as claimed m clann 7, wherein sard 
hfghet le\el sectum mode includes banning access to at least one pt ^determined 
computer file type. 



